Skip to content

Commit 3bed917

Browse files
DahuKDahuK
committed
add alibabacloud secret manager signing plugin for notation
1 parent 8d7bfe7 commit 3bed917

File tree

15 files changed

+1396
-0
lines changed

15 files changed

+1396
-0
lines changed

‎.gitignore‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# If you prefer the allow list template instead of the deny list, see community template:
2+
# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
3+
#
4+
# Binaries for programs and plugins
5+
*.exe
6+
*.exe~
7+
*.dll
8+
*.so
9+
*.dylib
10+
11+
# Test binary, built with `go test -c`
12+
*.test
13+
14+
# Output of the go coverage tool, specifically when used with LiteIDE
15+
*.out
16+
17+
# Dependency directories (remove the comment below to include it)
18+
vendor/
19+
20+
# Go workspace file
21+
go.work
22+
23+
# Ide file
24+
.idea/

‎Makefile‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
MODULE = github.com/AliyunContainerService/notation-alibabacloud-secret-manager
2+
PLUGIN = notation-alibabacloud-secret-manager
3+
GIT_TAG = $(shell git describe --tags --abbrev=0 --exact-match 2>/dev/null)
4+
BUILD_METADATA =
5+
ifeq ($(GIT_TAG),) # unreleased build
6+
GIT_COMMIT = $(shell git rev-parse HEAD)
7+
GIT_STATUS = $(shell test -n "`git status --porcelain`" && echo "dirty" || echo "unreleased")
8+
BUILD_METADATA = $(GIT_COMMIT).$(GIT_STATUS)
9+
endif
10+
LDFLAGS=-buildid= -X sigs.k8s.io/release-utils/version.gitVersion=$(GIT_VERSION) \
11+
-X sigs.k8s.io/release-utils/version.gitCommit=$(GIT_HASH) \
12+
-X sigs.k8s.io/release-utils/version.gitTreeState=$(GIT_TREESTATE) \
13+
-X sigs.k8s.io/release-utils/version.buildDate=$(BUILD_DATE)
14+
15+
GO_BUILD_FLAGS = --ldflags="$(LDFLAGS)"
16+
17+
PLATFORMS=darwin linux windows
18+
ARCHITECTURES=amd64
19+
20+
.PHONY: help
21+
help:
22+
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-25s\033[0m %s\n", $$1, $$2}'
23+
24+
.PHONY: all
25+
all: build
26+
27+
.PHONY: FORCE
28+
FORCE:
29+
30+
bin/%: cmd/% FORCE
31+
go build $(GO_BUILD_FLAGS) -o bin/notation-alibabacloud.secretmanager.plugin ./$<
32+
33+
.PHONY: cross
34+
cross:
35+
$(foreach GOOS, $(PLATFORMS),\
36+
$(foreach GOARCH, $(ARCHITECTURES), $(shell export GOOS=$(GOOS); export GOARCH=$(GOARCH); \
37+
env CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)" -o $(PLUGIN)-$(GOOS)-$(GOARCH) ./cmd/$(PLUGIN) ))) \
38+
env GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)" -o $(PLUGIN)-darwin-arm64 ./cmd/$(PLUGIN)
39+
env GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -trimpath -ldflags "$(LDFLAGS)" -o $(PLUGIN)-linux-arm64 ./cmd/$(PLUGIN)
40+
41+
.PHONY: download
42+
download: ## download dependencies via go mod
43+
go mod download
44+
45+
.PHONY: build
46+
build: $(addprefix bin/,$(PLUGIN)) ## builds binaries
47+
48+
.PHONY: clean
49+
clean:
50+
git status --short | grep '^!! ' | sed 's/!! //' | xargs rm -rf
51+
52+
.PHONY: test
53+
test:
54+
go test ./... -coverprofile cover.out

‎README.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
2+
# Alibaba Cloud Secret Manager plugin for Notation
3+
4+
This repository contains the implementation of the [Alibaba Cloud Secret Manager](https://www.alibabacloud.com/help/en/kms/support/overview-6) signing plugin for [Notation](https://notaryproject.dev/). This project is still in early development status.
5+
6+
> **Note** The Notary Project documentation is available [here](https://notaryproject.dev/docs/). You can also find the Notary Project [README](https://github.com/notaryproject/.github/blob/main/README.md) to learn about the overall Notary Project.
7+
8+
## Quick start
9+
10+
This document demonstrates how to sign and verify an OCI artifact with Alibaba Cloud Secret Manager plugin for Notation.
11+
12+
13+
#### Plugin Spec Compatibility
14+
15+
| Capability | Compatibility |
16+
| --------------------- | ------------------------------------------------------------ |
17+
| keySpec | `RSA-2048`, `RSA-3072`, `EC-256` |
18+
| hashAlgorithm | `SHA-256` |
19+
| signingAlgorithm | `RSASSA-PSS-SHA-256`, `ECDSA-SHA-256` |
20+
| pluginCapability | `SIGNATURE_GENERATOR.RAW`, `SIGNATURE_VERIFIER.TRUSTED_IDENTITY`, `SIGNATURE_VERIFIER.REVOCATION_CHECK` |
21+
| signingScheme | `notary.x509` |
22+
23+
24+
25+
## Getting Started:
26+
27+
The following summarizes the steps to configure the notation-alibabacloud-secret-manager plugin and sign and verify a container image. The following steps are based off of the Notation hello-signing [example](https://github.com/notaryproject/notation-plugin-framework-go/tree/main/example).
28+
29+
- Install notation [CLI](https://github.com/notaryproject/notation/releases/tag/v1.1.1). Version v1.1.1 has been tested. Note that `make install` creates the plugin directory structure based on a MacOS environment. Update the Makefile based on your OS. It then copies the plugin to the appropriate location based on the notation plugin directory structure spec.
30+
31+
- This plugin leverages the [KMS Instance SDK](https://www.alibabacloud.com/help/en/kms/developer-reference/kms-instance-sdk-for-go/), which means you'll need to meet the pre-requisites and customize the environment as follows：
32+
33+
| Env | Description |
34+
| --------------------- | ------------------------------------------------------------ |
35+
| ALIBABA_CLOUD_ACCESS_KEY_ID | Alibaba Cloud Account Access Key ID |
36+
| ALIBABA_CLOUD_ACCESS_KEY_SECRET | Alibaba Cloud Account Secret Access Key |
37+
| ALIBABA_CLOUD_KMS_INSTANCE_ENDPOINT | VPC Endpoint of the Dedicated KMS Instance, for example, kst-hzxxxxxxxxxx.cryptoservice.kms.aliyuncs.com |
38+
| ALIBABA_CLOUD_KMS_CLIENTKEY_FILEPATH | Local File Path of the ClientKey Credential for the Dedicated KMS Instance Application Access Point (AAP) |
39+
| ALIBABA_CLOUD_KMS_PASSWORD | Password for the Dedicated KMS Instance Application Access Point (AAP) |
40+
| ALIBABA_CLOUD_KMS_CA_FILEPATH | Local Path of the CA Certificate for the Dedicated KMS Instance |
41+
42+
*Note: the notation-alibabacloud-secret-manager plugin supports various Credential configuration methods. For more details, please refer to [credentials](https://aliyuncontainerservice.github.io/ack-ram-tool/#credentials)*
43+
44+
45+
## Installation
46+
47+
Install the notation-alibabacloud-secret-manager plugin for remote signing and verification, using the `notation plugin install` command:
48+
49+
#### Build and Install from Source
50+
51+
```bash
52+
git clone
53+
cd notation-alibabacloud-secret-manager
54+
make build
55+
```
56+
## Generate and import the keypair meterial
57+
58+
A user can bring their own private key and certificate. As a quick start, this tutorial is using openssl to generate a private key and a certificate
59+
60+
1. Create an asymmetric key in KMS console, please refer to [step1](https://www.alibabacloud.com/help/en/kms/user-guide/import-key-material-into-an-asymmetric-key#p-qcf-3d4-pel)
61+
2. Download a wrapping public key and an import token, please refer to [step2](https://www.alibabacloud.com/help/en/kms/user-guide/import-key-material-into-an-asymmetric-key#p-f9p-n7u-88m)
62+
3. Use the wrapping public key to encrypt key material, please refer to [step3](https://www.alibabacloud.com/help/en/kms/user-guide/import-key-material-into-an-asymmetric-key#p-jar-kxa-iun)
63+
4. Import key material, please refer to [step4](https://www.alibabacloud.com/help/en/kms/user-guide/import-key-material-into-an-asymmetric-key#p-j5c-vp9-9vd)
64+
![](./docs/import_key.png)
65+
66+
5. Create an x509 certificate based on the private key TakPrivPkcs1.pem from step 3 above and the server_cert configuration in [openssl.cnf]((./docs/import_key.png)).
67+
```bash
68+
openssl req -x509 -new -nodes -key TakPrivPkcs1.pem -sha256 -days 3650 -out sign.crt -config openssl.cnf -extensions server_cert
69+
```
70+
71+
72+
## Sign an artifact using Notation
73+
Now we've done all the configurations. Let's sign an artifact using Notation. (If you haven't done so, download notation from [here](https://github.com/notaryproject/notation/releases).)
74+
```bash
75+
notation sign --id <keyId> --plugin alibabacloud.secretmanager.plugin <myRegistry>/<myRepo>@<digest> --plugin-config ca_certs=<certPath>
76+
```
77+
Note: the `--id` should be identical to your specific key id in Alibaba Cloud KMS Service instance and the `ca_certs` in ` --plugin-config` should be identical to the file path of the x509 certificate generated in step 5 above.
78+
79+
80+
## Verify the artifact using Notation
81+
1. Configure trust store.
82+
```bash
83+
./notation cert add -t ca -s myStore "{path-to-cert}/sign.crt"
84+
```
85+
where `sign.crt` is the cert generated in the previous step.
86+
2. Configure the trust policy.
87+
```bash
88+
cat <<EOF > ./trustpolicy.json
89+
{
90+
"version": "1.0",
91+
"trustPolicies": [
92+
{
93+
"name": "acr-hangzhou-images",
94+
"registryScopes": [ "<myRegistry>/<myRepo>" ],
95+
"signatureVerification": {
96+
"level" : "strict"
97+
},
98+
"trustStores": [ "ca:ack.notation" ],
99+
"trustedIdentities": [
100+
"*"
101+
]
102+
}
103+
]
104+
}
105+
EOF
106+
```
107+
```bash
108+
./notation policy import ./trustpolicy.json
109+
```
110+
3. Verify the artifact
111+
```bash
112+
./notation verify <myRegistry>/<myRepo>@<digest> -v
113+

‎SECURITY.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Security Policy
2+
3+
- [Security Policy](#security-policy)
4+
- [Reporting security problems](#reporting-security-problems)
5+
- [Vulnerability Management Plans](#vulnerability-management-plans)
6+
- [Critical Updates And Security Notices](#critical-updates-and-security-notices)
7+
8+
## Reporting security problems
9+
10+
**DO NOT CREATE AN ISSUE** to report a security problem. Instead, please
11+
send an email to **kubernetes-security@service.aliyun.com**
12+
13+
Please follow the [embargo policy](./embargo-policy.md) for all security-related problems.
14+
15+
## Vulnerability Management Plans
16+
17+
### Critical Updates And Security Notices
18+
19+
We learn about critical software updates and security threats from these sources
20+
21+
1. GitHub Security Alerts
22+
2. [Dependabot](https://dependabot.com/) Dependency Updates

‎cmd/notation-alibabacloud-secret-manager/main.go‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Copyright The Notary Project Authors.
2+
// Licensed under the Apache License, Version 2.0 (the "License");
3+
// you may not use this file except in compliance with the License.
4+
// You may obtain a copy of the License at
5+
//
6+
// http://www.apache.org/licenses/LICENSE-2.0
7+
//
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
14+
package main
15+
16+
import (
17+
"context"
18+
"fmt"
19+
"os"
20+
21+
"github.com/notaryproject/notation-plugin-framework-go/cli"
22+
)
23+
24+
func main() {
25+
ctx := context.Background()
26+
// Initialize plugin
27+
plugin, err := NewAlibabaCloudSecretManagerPlugin()
28+
if err != nil {
29+
_, _ = fmt.Fprintf(os.Stderr, "failed to initialize plugin: %v\n", err)
30+
os.Exit(2)
31+
}
32+
33+
// Create executable
34+
pluginCli, err := cli.New(plugin)
35+
if err != nil {
36+
_, _ = fmt.Fprintf(os.Stderr, "failed to create executable: %v\n", err)
37+
os.Exit(3)
38+
}
39+
pluginCli.Execute(ctx, os.Args)
40+
}

0 commit comments

Comments
 (0)